Read the docs
TI-2022-18733 Aliases CVE-2022-39358

Metabase vulnerable to circumvention of Locked parameter in Signed Embedding

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00538 45th percentileScored 2026-11-07
Fix Fixed metabase (metabase): 0.42.6, 0.43.7, 0.44.5 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Metabasemetabasebefore 0.42.6; 0.43.0 to before 0.43.7; 0.44.0 to before 0.44.5; 1.0.0 to before 1.42.6; 1.43.0 to before 1.43.7; 1.44.0 to before 1.44.50.42.6, 0.43.7, 0.44.5, 1.42.6, 1.43.7, 1.44.5Patch availableCNA
  • metabase VendorMetabase Affected before 0.42.6; 0.43.0 to before 0.43.7; 0.44.0 to before 0.44.5; 1.0.0 to before 1.42.6; 1.43.0 to before 1.43.7; 1.44.0 to before 1.44.5 Fixed in 0.42.6, 0.43.7, 0.44.5, 1.42.6, 1.43.7, 1.44.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*0.42.0 to before 0.42.6; 0.43.0 to before 0.43.7; 0.44.0 to before 0.44.5; 1.42.0 to before 1.42.6; 1.43.0 to before 1.43.7; 1.44.0 to before 1.44.5VulnerableMetabase
  • cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:* Versions 0.42.0 to before 0.42.6; 0.43.0 to before 0.43.7; 0.44.0 to before 0.44.5; 1.42.0 to before 1.42.6; 1.43.0 to before 1.43.7; 1.44.0 to before 1.44.5 Vulnerable ·Metabase

Remediation

  • Fix · CNA metabase (metabase) Fixed in 0.42.6, 0.43.7, 0.44.5, 1.42.6, 1.43.7, 1.44.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39358

References

Advisory 1

  • TI-2026-51115 Metabase SQL injection via password reset endpoint KEVCVSS 4.0CRITICAL 10.0
  • TI-2021-18109 GeoJSON URL validation can expose server files and environment variables to unauthorized users KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-20003 Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow… CVSS 3.1CRITICAL 9.8
  • TI-2022-08664 File system exposure in Metabase CVSS 3.1MEDIUM 5.9
  • TI-2025-05321 Metabase dom.js parseDataUri redos CVSS 4.0MEDIUM 5.3
  • TI-2023-19078 Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint CVSS 3.1CRITICAL 10.0
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences